WO2007125212A2

WO2007125212A2 - Method and device for customizing a portable electronic entity

Info

Publication number: WO2007125212A2
Application number: PCT/FR2007/000732
Authority: WO
Inventors: Régis MOUNIER; Jean-Marc Louis
Original assignee: Oberthur Technologies
Priority date: 2006-04-27
Filing date: 2007-04-27
Publication date: 2007-11-08
Also published as: WO2007125212A3; FR2900483B1; FR2900483A1

Abstract

The device (200) for customizing a portable electronic entity (100) having a memory (140) comprises: processing means (220, 230) suitable for processing customization data (436, 450, 602 to 608) and for generating at least one group of instructions for customizing the portable electronic entity, at least one group of customization instructions comprising at least one customization monitoring instruction (602 to 608) allowing a customization station (240) to monitor the proper execution of at least one customization instruction and means (235) for sending each group of customization instructions. Preferably, at least one customization instruction is an instruction that is directly comprehensible and executable by the portable electronic entity. In embodiments, at least one monitoring instruction is the expected result of the execution, by the portable electronic entity, of a customization instruction.

Description

METHOD AND DEVICE FOR CUSTOMIZING AN ENTITY

PORTABLE ELECTRONICS

The invention relates to a method and a device for personalizing a portable electronic entity. It applies, in particular, to the personalization of microcircuit cards according to user profiles.

The invention relates to portable electronic entities including, in particular, microcircuit cards, memory cards such as a digital data storage memory card, for example a "Secure Digital" card or an SD card (registered trademark ), a USB stick (acronym for "universal serial bus" for universal serial bus), a MultiMediaCard or an MMC card (registered trademarks), a Smartmedia (registered trademark) card, a mini multimedia card or a PDA (acronym for " Personal Digital Assistant "for personal digital assistant), also called organizer. The microcircuit card is, for example, in accordance with the ISO 7816 standard. It may, for example, be a secure microcontroller card.

The use of an electronic entity in a given application framework involves storing, in the electronic entity, data and / or programs that can be used in this context. This is why it is frequently used, in particular for portable electronic entities at a personalization stage during which the data specific to it are recorded in a memory of the electronic entity, such as, for example, the identity of the electronic entity. card holder.

The customization is performed by a personalization station that performs a personalization data processing. The portable electronic entity comprises a rewritable non-volatile memory, for example, an EEPROM (acronym for "Electrically Erasable and Programmable Read OnYy Memory" for programmable read-only and electrically erasable). Electrical customization essentially consists of a step of initialization of this non-volatile memory and thus of the portable electronic entity. This memory is particularly suitable for storing this type of data that varies from one electronic entity to another.

It should be noted that before this initialization, the portable electronic entity can not function. It can only be personalized. Similarly, before the personalization step, the non-volatile memory may be blank or almost blank, that is to say, it is not initialized.

The step of initializing the non-volatile memory is a step during which non-volatile memory is memorized specific information of the application functions of the portable electronic entity and / or specific of each carrier of the portable electronic entity. . The personalization data is generally stored in a rewritable non-volatile memory.

Document US Pat. No. 5,889,941 discloses a personalization system that maintains a database containing data format files of the issuer of the portable electronic entity ("issuer" in English terminology), command files of the portable electronic entity operating system, application files and specifications of personalization equipment. This personalization system generates commands or a series of personalization commands for personalization equipment from these files. In the architecture of this system, a personalization station controls each personalization machine.

However, these personalization stations generally have limited computer processing means. These stations have the disadvantage of having insufficient power processing means in view of increasingly complex processing, data of customization. These delays are related to the fact that customization tools have processing speeds of several thousand cards per hour.

To remedy this drawback, US 6,196,459 discloses the use of a server that performs the personalization data processing, so as to lighten the workload of personalization station processing means. However, this approach also has drawbacks in terms of efficiency. Indeed, the customization station is regularly waiting during exchanges with the server, that is to say during processing performed by the server and during communications with the server.

It is also known, from US 6,575,360, a personalization system comprising a smart card control system and a smart card administration system. The smart card control system interfaces with the smart card and transparently transmits, i.e. without processing other than decoding or encoding, on the one hand, the commands developed by the administration system to the smart card and, secondly, the responses to these commands developed by the smart card to the administration system. This system also has the disadvantage of requiring significant exchanges between the control system of the smart card and the management system of the smart card. In addition, the control system is on standby, that is to say does not perform any processing, between the time it provides a response developed by the card to the administration system and the moment it receives a new order from the administration system. Consequently, in a system where thousands or tens of thousands of cards per hour must be processed, these exchanges can limit the rate of personalization of the cards, especially when only one administration system is used for communication with several stations. of personalization. The present invention aims to remedy these disadvantages. For this purpose, the present invention aims, in a first aspect, a device for customization of a portable electronic entity comprising a memory, characterized in that it comprises:

processing means adapted to process personalization data and to generate at least one group of personalization instructions for the portable electronic entity, at least one group of personalization instructions comprising at least one personalization control instruction allowing a personalization station to control the correct execution of at least one personalization instruction and

means for transmitting each group of personalization instructions.

This first aspect of the present invention particularly relates to a device consisting of a personalization server. Thus, in order to improve personalization rates, the invention achieves two objectives, which are a priori contradictory: - make most of the processing on a personalization server, and limit the processing performed by personalization stations.

- Limit the data exchange between the personalization stations and the personalization server. These objectives are achieved in particular through the development of personalization instructions groups by the personalization server. Thus, the personalization station does not have to elaborate the personalization instructions and does not have to request the personalization instructions one by one. Finally, the personalization server also has a role of defining the personalization controls that are executed by the personalization station. The support, by the personalization station, of these control instructions defined by the personalization device makes it possible to limit the exchanges between the personalization stations and the server, while limiting as much as possible the treatments carried out by the personalization stations. According to particular characteristics, at least one personalization instruction is a directly understandable and executable instruction by the portable electronic entity.

Thanks to these provisions, the personalization station does not have to interpret the personalization instructions directly understandable and executable by the portable electronic entity and only sends them.

According to particular features, at least one customization instruction of a group of personalization instructions allows the registration by the portable electronic entity of data in the memory of the portable electronic entity.

According to particular features, at least a portion of the data stored in the memory of the portable electronic entity is specific to the future bearer of the portable electronic entity.

According to particular characteristics, at least one control instruction is the result expected from the execution, by the portable electronic entity, of a personalization instruction. The control is therefore particularly easy to implement. The control of the expected result of the execution, by the portable electronic entity, of a customization instruction is the minimum control instruction which minimizes the processing carried out by the personalization station and the exchanges between the personalization station. and the server.

According to particular characteristics, at least one personalization instruction is an order in APDU format of the ISO 7816 standard.

According to particular characteristics, at least one control instruction is an answer, in the APDU format of the ISO 7816 standard, of a personalization instruction.

The present invention thus applies to electronic entities implementing this standard.

According to particular characteristics, at least one control instruction is one of the following instructions:

a command for powering up the portable electronic entity, a command to switch off the portable electronic entity,

a command for selecting the applied clock of the portable electronic entity; a command for determining a communication protocol between the personalization station and the portable electronic entity;

a command for selecting the voltage applied to the portable electronic entity,

a suspension control of the personalization for a determined duration,

a specification command at the station for personalizing a maximum waiting time to obtain a response from the portable electronic entity,

a command for inserting a waiting time before each command sent to the portable electronic entity,

a command for inserting data into said report sent to the attention of the server,

an end of customization command and / or

a personalization anomaly information command. According to particular features, the processing means are further adapted to generate at least one personalization report instruction enabling the personalization station to confirm to the device the correct execution of at least part of a group personalization instructions, the transmission means being adapted to transmit at least one report instruction to the personalization station, the device further comprising means for receiving at least one report from the personalization station. Thus, the device can verify the good realization of the customization.

According to particular features, the processing means are adapted to insert at least one report instruction into at least one group of personalization instructions. Thanks to these provisions, the exchanges of instructions between the personalization device and the station of personalization are limited to groups of personalization instructions including both instructions to be performed to the portable electronic entity and reporting instructions.

According to particular features, the device as succinctly set forth above further comprises analysis means able to analyze at least one received report and to trigger an action according to the result of said analysis. Thus, it is the server that provides the personalization control and thus unloads the stations to the maximum of treatment spots. According to particular features, the processing means comprise means for defining groups of instructions such that the device needs the execution report of at least one of the preceding instructions to generate the first instruction of the next group of instructions. customization instructions. With these provisions, the size of the groups of instructions is maximum and the interactions between the device and the personalization station are reduced, which increases the rate of customization.

According to particular features, the processing means are adapted to generate a specific instruction representative of the end of personalization of a portable electronic entity.

According to particular features, the processing means are adapted so that said specific instruction representative end of personalization is positioned at the end of a group of personalization instructions. According to particular features, the processing means are adapted so that said specific instruction representing the end of personalization is the only personalization instruction of a group of personalization instructions.

According to particular features, the device as briefly described above comprises, in addition, means for receiving at least one identifier of the portable electronic entity. According to particular characteristics, said identifier is an answer to initialization, or "answer to reset".

According to particular features, the means for receiving at least one identifier of the portable electronic entity are adapted to receive, in addition, at least one identifier of said personalization station.

With each of these arrangements, the server can generate the personalization instruction groups based on an electronic entity identifier received, for example, from the personalization station. This limits the risk of error. According to particular features, the processing means are adapted to generate at least one group of personalization instructions in parallel with the execution of a group of personalization instructions by the personalization station.

Thanks to these provisions, the personalization rate can be increased because as soon as a group of personalization instructions has been executed by the personalization station, another group of personalization instructions can be sent to it by the device, without having wait for this new set of customization instructions to be prepared.

According to particular features, the processing means are adapted to generate at least one group of personalization instructions in which the first personalization instruction is an instruction involved in a cryptographic process.

According to particular features, the device as briefly described above comprises a server and in that the transmission means are adapted to transmit groups of personalization instructions to a plurality of personalization stations.

According to particular features, the portable electronic entity is a card or an identification document.

According to particular features, the portable electronic entity is of the slave type. According to a second aspect, the present invention aims at a personalization device of a portable electronic entity comprising a memory, characterized in that it comprises:

means for receiving at least one group of personalization instructions for the portable electronic entity, at least one group of instructions comprising at least one personalization control instruction making it possible to check the correct execution of at least one customization instruction,

means for transmitting at least one personalization instruction to the portable electronic entity and

processing means adapted to process each control instruction to check the correct execution of at least one personalization instruction by the portable electronic entity.

According to particular characteristics, at least one personalization instruction is a directly understandable and executable instruction by the portable electronic entity.

According to particular characteristics, at least one customization instruction of a group of personalization instructions allows the data entry, by the portable electronic entity, in the memory of the portable electronic entity.

According to particular characteristics, at least one control instruction is the result expected from the execution, by the portable electronic entity, of a personalization instruction.

According to particular characteristics, at least one control instruction is an answer, in the APDU format of the ISO 7816 standard, of a personalization instruction. According to particular characteristics, at least one control instruction defines a maximum duration during which the response is expected from the portable electronic entity to a personalization instruction. According to particular characteristics, at least one control instruction is one of the following instructions:

a command for powering up the portable electronic entity,

a command to switch off the portable electronic entity,

a command for selecting the applied clock of the portable electronic entity,

a command for determining a communication protocol between the personalization station and the portable electronic entity, a command for selecting the voltage applied to the portable electronic entity,

a suspension control of the personalization for a determined duration,

an end of customization command and / or

a personalization anomaly information command. According to particular features, the processing means are adapted to perform at least one control instruction of at least one personalization instruction after the transmission means have transmitted, to the portable electronic entity, another personalization instruction not concerned. by said control instruction. Thus, while awaiting the response of the electronic entity to a personalization instruction, the personalization station can analyze the response of the previous personalization instruction and insert the necessary information into said report. According to particular features, the receiving means are further adapted to receive at least one personalization report instruction and the processing means are further adapted to prepare an execution report of least a group of personalization instructions, the device further comprising means for sending reports to a personalization server.

According to particular features, the reception means are adapted to extract at least one report instruction from at least one group of personalization instructions.

According to particular features, the processing means comprise a buffer in which are stored the personalization instructions transmitted to the portable electronic entity and the results of the execution of at least part of the personalization control instructions, an account -rendu comprising all or part of the contents of said buffer memory. According to particular features, the device as briefly described above further comprises means for sending, to a personalization server, at least one identifier of the portable electronic entity.

According to particular characteristics, said identifier is an answer to initialization, or "answer to reset".

According to particular features, said transmission means are adapted to associate with each portable electronic entity identifier, an identifier of the device.

According to particular features, the device as briefly described above comprises means for transmitting a message end of batch. According to particular features, the device as briefly described above comprises means for counting the portable electronic entities, the processing means being adapted to generate said end of batch message when the counting means have determined that a batch of Portable electronic entities has been customized.

According to particular features, the device as briefly described above comprises anomaly detecting means and means for transmitting a fault message.

According to particular features, the portable electronic entity is of the slave type.

According to a third aspect, the present invention aims at a method of personalization of a portable electronic entity comprising a memory, characterized in that it comprises:

a step of processing personalization data and generating at least one group of personalization instructions of the portable electronic entity, at least one group of personalization instructions comprising at least one personalization control instruction allowing a personalization station to control the proper execution of at least one personalization instruction and

a step of transmitting each group of personalization instructions to the personalization station of the portable electronic entity. According to a fourth aspect, the present invention aims at a method of personalization of a portable electronic entity comprising a memory, characterized in that it comprises:

a step of receiving at least one group of personalization instructions of the portable electronic entity, at least one group of instructions comprising at least one personalization control instruction making it possible to check the correct execution of at least one customization instruction and a step of transmitting at least one personalization instruction to the portable electronic entity.

Since the advantages, aims and characteristics of the device that is the subject of the second aspect of the present invention and the methods that are the subject of the third and fourth aspects being similar to those of the device that is the subject of the first aspect of the present invention, they are not recalled here.

Other aims, features and advantages of the invention will become apparent in the light of the description which follows, given for an explanatory and in no way limiting purpose, with reference to the appended drawings, in which: FIG. 1 represents, schematically, a portable electronic entity to the personalization of which the present invention applies,

FIG. 2 represents, schematically, a particular embodiment of a system, a server and a personalization station which are the subject of the present invention; FIG. 3 represents, in the form of a logic diagram, steps implemented in a particular embodiment of the personalization method that is the subject of the present invention,

FIGS. 4A to 41 represent, schematically, frames of data exchanged between different entities for the implementation of a particular embodiment of the method that is the subject of the present invention,

FIG. 5 represents, in the form of a logic diagram, steps implemented in one of the steps illustrated in FIG.

FIGS. 6A to 61 schematically represent frames of data exchanged between different entities for the implementation of a particular embodiment of the method that is the subject of the present invention.

The invention relates to the personalization of a portable electronic entity. It is recalled that during such customization, the data that is specific to this entity, to application functions of the entity, are entered in a memory of the electronic entity, for example, types of authorized services, functions of security and cryptographic sometimes called initialization data, and / or specific of the future carrier of the portable electronic entity, for example, the name, the account or telephone number, the date validity limit and / or photograph. The customization covers, in particular, the production of "softmasks" or software masks in the case of a microcircuit card.

It can be observed that in some prior art documents, the notion of initialization is distinguished from that of personalization. Within the meaning of the present invention, these two notions are grouped under the same term of "personalization", even if these steps can be distinct, and carried out, for example, by different personalization stations, for example for security reasons. An example of a portable electronic entity 100 is shown in FIG. 1. This portable electronic entity 100 may be a microcircuit card, an identification document, a USB key, a PDA, or a microcircuit card for example according to the specification. MMC (MultiMediaCard) including a memory for example Flash type. This may be a contactless smart card or a card called dual, that is to say comprising a contactless interface and a contact interface, for example compliant with the ISO 14443 standard. portable electronic entity 100 may also be a passport comprising in the thickness of the cover a secure microcontroller provided with contactless communication means according to ISO 14443.

In the case of a microcircuit card, and from an application point of view, the portable electronic entity 100 is in particular a secure identification card or a secure identification document, that is to say, by for example, a bank card, an identification card of a subscriber of a mobile telephone network, or a card or an official document or transport document (transport card, identity card, motor vehicle identification card gray card type, ...).

In the embodiment illustrated in FIG. 1, the portable electronic entity 100 is a microcircuit card of dimension preferably according to the ISO 7816 standard, in particular of 0.76 mm. thick. It includes an input-output interface, power supply and clock signal supply 110, a secure microcontroller 120, a ROM ROM 130 and an electrically erasable EEPROM 140.

The interface 110 may comprise a contact or non-contact communication interface or an interface called dual, that is to say comprising a short-range contactless interface and a contact interface.

The read-only memory 130 retains an operating system that allows the portable electronic entity 100 to operate, that is, to receive and execute instructions or commands conforming to the ISO 7816 standard, and to secure the portable electronic entity 100. The personalization of the portable electronic entity consists, in particular, in initializing the memory 140 by creating files and / or variables, for example in the form of a structure known as the TLV (acronym of "tag length value" for label length value).

According to one mode of operation, the portable electronic entity 100 is of slave type, in the sense that the electronic entity only responds to commands from the master terminal. In an implementation of the invention within a microcircuit card, the master terminal is, in particular, a card reader. In this case, the portable electronic entity, microcircuit, is preferably compliant with ISO 7816. It is usually in this case a secure microcontroller card.

FIG. 2 shows a personalization system comprising a personalization server 200 and a personalization station 240 communicating with a portable electronic entity 100.

The personalization server 200 includes a personalization data entry 205, a nonvolatile memory 210, for example a hard disk, which stores a program 220 and a CPU 230. The program 220 is a processing and control program generating groups of instructions based on personalization data and, possibly, an identifier of the portable electronic entity 100. The CPU 230 and the program 220 jointly constitute processing means adapted to process data. personalization and identifiers of portable electronic entities and to generating at least one group of personalization instructions of the portable electronic entity.

The instructions generated by these processing means preferably comprise personalization instructions, control instructions and reporting instructions. The personalization instructions are understandable and executable by the portable electronic entity 100. In accordance with the present invention, these personalization instructions are grouped, by the personalization server 200, in groups of personalization instructions, at least one group of personalization instructions. instructions comprising a plurality of personalization instructions and, explicitly or implicitly, at least one control instruction and, optionally, at least one report instruction.

The control instructions may be any instruction for the personalization station 240 enabling it to control the execution of the personalization instructions by the portable electronic entity 100. Preferentially, the control instructions allow the station 240 to verify the execution of each customization instruction by the portable electronic entity 100. Thus, these control instructions can define a maximum duration during which the customization station 240 can wait, on behalf of the electronic entity. portable 100, a response to a specific customization instruction. In this embodiment, said control instruction is advantageously the expected APDU response to a personalization instruction in the form of an APDU command. The reporting instructions determine when and how the personalization station 240 should communicate with the personalization server 200 to indicate that at least a portion of a group of personalization instructions of an entity is performing correctly. Preferably, the report instruction is embodied implicitly by the end of the instruction group, that is to say that each time the personalization station 240 reaches the end of a group. instructions, it sends, to the personalization server 200, a report which represents the successful execution of each control statement. This particular type of reporting instruction is particularly simple to implement. In other variants, the personalization server 200 inserts explicit reporting instructions into the personalization instruction group.

Preferably, the processing and control means, that is to say the non-volatile memory 210, the program 220 and the processing unit 230 of the server 200, comprise means for analyzing the reports received from the station of personalization, these analysis means comprising, in particular, the nonvolatile memory 210 and the program 220.

Preferably, the processing and control means are adapted to generate at least one group of personalization instructions in parallel with the execution, by the personalization station, of another group of personalization instructions. Advantageously, the means for processing and controlling the server

200 include means for defining groups of instructions such that the personalization server 200 needs the execution report of at least one of the preceding instructions to generate the first instruction of the next group of personalization instructions. Thus, during the generation of groups of instructions, the means for defining groups of instructions determine, for each instruction, whether its generation requires a report of execution of at least one of the preceding instructions. If so, the instruction group definition means terminates the preceding instruction group before this instruction to be generated based on this report and defines a new group of personalization instructions starting with said instruction. This operation of the instruction group definition means makes it possible to minimize the exchanges between the server and the personalization station.

For example, the first instruction of the new instruction group is an instruction involved in a cryptographic process. According to another example, it is an instruction for storing an element in the electronic entity (for example a flash memory card), the element to be memorize depending on the available memory space in the electronic entity. The first instruction of the new group of instructions therefore requires the report of the execution of an instruction for determining the available memory space in said entity 100, which instruction is, as explained above, in the previous group of instructions.

As a variant, the number of instructions of the group of instructions can be fixed or determined by the expected size of said report.

The processing and control means 210 to 230 include means for issuing control instructions for the personalization station 240. This allows the personalization server 200 to control the personalization station 240 by using some of the means used for the personalization stations 240. groups of customization instructions.

The control instructions of the personalization station 240 include, preferably: a command to turn on the power of the portable electronic entity,

a command to switch off the portable electronic entity,

a command for selecting the applied clock of the portable electronic entity,

a command for determining a communication protocol between the personalization station and the portable electronic entity. In one embodiment where the portable electronic entity is a microcircuit card, said protocol selection control allows a selection of the T = 1 protocol and the T = O protocol defined in accordance with ISO 7816. In one embodiment said protocol determination command makes it possible to negotiate the transmission speed of the data exchanged between the portable electronic entity and the personalization station,

a command for selecting the voltage applied to the electronic entity,

a suspension control of the personalization for a determined duration, a specification command at the station for personalizing a maximum waiting time to obtain a response from the portable electronic entity,

a command for inserting data into said report sent to the server (advantage: makes it easier to check the server)

an end of personalization command and / or a personalization anomaly information command.

These instructions therefore include instructions controlling the personalization station 240 that define steps that it must implement during the customization process of the portable electronic entity 100. Certain instructions thus cause, within the station, customization 240, the formatting of signals intended for the portable electronic entity 100 (annexes to commands directly executable by the portable electronic entity 100 and therefore distinct from them) and the application of these by means of the reader 280.

Preferably, the transmission means are adapted to transmit groups of personalization instructions to a plurality of personalization stations.

The personalization server 200 communicates with each personalization station 240 according to any protocol, preferably encrypted, via transmission means 235 of each group of personalization instructions to the personalization station 240 of the entity Conversely, the transmitting means 235 constitute means for receiving, from the personalization station 240, at least one identifier of the portable electronic entity 100 and of the execution report of the device. customization instructions. The customization station 240 comprises a non-volatile memory

270 retaining drivers 265 (English "driver") drive driver 280 portable electronic entity 100 and a group management program The personalization station 240 also includes a clock generator 245, a power supply 250, a driver control circuit 255 280 and a CPU 260.

The CPU 260 and the instruction group management program 275 constitute means for receiving at least one group of personalization instructions for the portable electronic entity.

The reader 280 is provided with an interface with or without contact with the portable electronic entity 100. The reader 280 exchanges, with the portable electronic entity 100, instructions or commands, and responses, for example APDU, clock and power supply, according to known techniques in the field of smart card readers. The central unit 260, the reader 280, the drivers 265 and the management program 275 thus constitute means for transmitting at least one personalization instruction to the portable electronic entity 100. The circuit 255 transmits to the generator 245 commands determining a clock signal, power supply 250, power-on, power-off and / or voltage determination commands and reader 280, APDU commands.

The operation of the personalization station 240 is illustrated in FIG.

During a step 300, the customization station 240 sends to the server 200 a request for initialization of the personalization comprising identification information of the entity batch 100 to be personalized in order to initialize the control processing means of the control. customization. In one embodiment, this identification information is a batch number, which has previously been linked personalization information necessary for personalization, for example information on the applications. In one embodiment, this personalization information includes the possible platforms for that batch. This request may also include identification information of the personalization station 240, including the station number in the personalization workshop, allowing the server 200 to address the response, and possibly the type of personalization station 240, the server 200 may need this information to know the instructions it can send to the station.

The server 200 then responds to personalization station 240, either by an error message, especially if the batch number is invalid, or by an acknowledgment of receipt if no problem has been encountered.

During a step 305, the personalization station 240 performs an automatic loading of a portable electronic entity 100 in the reader 280, according to techniques known per se. Then, during a step 310, the personalization station 240 detects and turns on the portable electronic entity 100.

During a step 315, the personalization station 240 identifies the portable electronic entity 100 and communicates an identifier of this entity 100 to the server 200 as well as a customization group request.

During a step 320, according to the identifier of the portable electronic entity and the personalization data received elsewhere, the personalization server 200 generates a group of personalization instructions and transmits them to the personalization station. 240, preferably in encrypted, coded or encrypted form.

Preferably, during this step 320, the personalization server 200 defines the first group of personalization instructions so that this group of instructions only ends when, for the next instruction, the server 200 needs the account. execution run of at least one of the preceding instructions.

In a step 325, the personalization station 240 receives the instruction group, i.e. performs the necessary decoding and / or analysis, and transmits each APDU command from the instruction group to the instruction group. portable electronic entity 100. Preferentially, the personalization station 240 carries out at least one control instruction of at least one personalization instruction after having transmitted, to the portable electronic entity, another personalization instruction not concerned by this control instruction.

If, for an APDU command, no control instruction included in the personalization instruction group received relates to this APDU instruction, the station 240 expects from the entity 100 a standard code which indicates that the instruction customization has been performed and checks this standard code.

Otherwise, the station 240 waits for a specific APDU response in a specific time interval, if that specific response and / or time interval is specified in a control instruction embedded in the received customization instruction group.

In case of a problem, that is to say, as the case may be, in the absence of reception of the standard code or of the response expected during the specific time interval, the personalization of the entity 100 is interrupted and a message d Personalization interruption is transmitted by the customization station 240 to the server 200.

In the absence of a problem, each response is placed in a buffer (in English "buffer"), in chronological order with other information of the personalization progress report (for example date, time, identifier entity 100).

When, during the processing of the customization instructions, a report instruction is encountered by the station 240, the latter sends, to the server 200, a report message, for example containing the contents of the memory buffer. When all personalization instructions have been processed, in a step 330, the station 240 sends a report message including, for example, the contents of the buffer, to the personalization server 200.

Upon receipt of each report message, the server 200 analyzes the report at step 335 and determines whether to trigger an action based on the result of that analysis. In particular, the server determines whether an error has been detected during step 340. If yes, at During a step 345, the error is processed. For example, an eject message from the entity 100 to a rebus is transmitted to the personalization station 240. Otherwise, during a step 350, the personalization server determines whether the personalization of the portable electronic entity 100 is finished. If so, during a step 360, a new portable electronic entity is loaded into the reader 280 and step 310 is returned. Otherwise, during a step 355, depending on the identifier of the portable electronic entity, the received account (s) and personalization data received elsewhere, the personalization server 200 generates a new group of personalization instructions and transmits them to the personalization station 240, preferentially in encrypted, coded or encrypted form.

Preferably, during this step 355, the personalization server 200 defines the new group of personalization instructions so that this group of instructions only ends when, for the next instruction, the server 200 needs the account. execution run of at least one of the preceding instructions. Then we return to step 325.

FIG. 5 illustrates, in detail, step 325. First, during a step 505, the personalization station 240 receives a group of personalization instructions from the server 200. Then, during in a step 510, the customization station 240 performs an extraction of the next instruction of the last group of personalization instructions received. During the first iteration of step 510, the next instruction is the first instruction. During a step 515, the personalization station 240 determines whether the retrieved instruction is associated with a control instruction, that is, here, identifies, in content or in maximum waiting time, a answer to expect from the portable electronic entity.

If so, during a step 525, the personalization station 240 extracts, from the group of personalization instructions, the identification of the response to be waited. Otherwise, during a step 520, the personalization station 240 stores, as expected response, an answer standard, independent of the personalization instruction and, as the maximum waiting time, a standard waiting time.

Following one of the steps 520 or 525, the personalization station extracts the APDU command from the extracted instruction and transmits it to the portable electronic entity 100, during a step 530. For example, this instruction allows the registration, by the portable electronic entity 100, of data in the nonvolatile memory EEPROM 140 of the portable electronic entity 100.

Then, during a step 535, the personalization station 240 waits for a response from the entity 100. When receiving a response from the entity 100 or at the end of the maximum duration of waiting, the personalization station writes the contents of the command and the response, possibly empty, to a report buffer, chronologically during a step 540. During a step 545, the station personalization 240 determines whether the response obtained is identical to the expected response. If not, during a step 550, the station 240 sends an error message to the server 200 as well as the contents of the report buffer. If yes, during a step 555, the customization station 240 determines whether the last group of instructions received still comprises at least one instruction. If not, step 325 is completed. If yes, go back to step 510.

FIG. 4A shows that a personalization initialization request 400, sent by the station 240 to the server 200, may comprise an initialization code 402, for example on 2 bytes, a lot number 404, for example on 2 bytes, and a station number 406, for example on 2 bytes.

The initialization request is sent once per batch as indicated next to step 300, in FIG.

An example of response 408 of the server 200 is given in FIG. 4B. It comprises an acknowledgment code 410. Another example of response 412 is given in FIG. 4C. It comprises a reception fault code 414 and an error number 416. When the batch is finished (the detection of the end of the batch is generally carried out by a sensor of the station 240, or by a count of portable electronic entities), the station 240 sends an end of personalization message to the server. This message 418, illustrated in FIG. 4D, comprises an end of batch code 420 and can comprise identification information of the batch and / or personalization machine 422.

Once the acknowledgment to the initialization command of the customization received, on detection of a new entity 100 in the reader 280, the station 240 communicates to the server 200, in a single command, the identifier, by example the ATR (acronym for "answer to reset" for response to initialization), the entity 100 and a customization group request of personalization. An example of such a control 424 is illustrated in Figure 4E. This command 424 includes an ATR communication code 426, a batch number 428, a personalization station identifier 430, for example a personalization station number, an ATR identifier length data item 432 and the ATR identifier 434. of variable length.

It is recalled that the ATR, the content of which is defined by the ISO 7816 standard, is the first response of a card after resetting (typically at power up). The ATR can contain, in so-called historical bytes, information on the platform (circuit and mask or circuit or mask) communicated to the reader 280. This is notably that information which is used by the server 200 to form the groups of instructions of personalization.

An exemplary response 436 of the server 200 is illustrated in FIG. 4F. This response 436 includes a personalization instruction group header 438 and a personalization instruction group 440, of variable length.

In another embodiment, the communication step of the identifier ATR is replaced by a simple personalization instruction group request sent by the station 240 to the server 200, on detection of a new entity 100, or, more generally, when launching a new batch of entities 100. An example of such a request 442 is illustrated in FIG. 4G and comprises a request code 444, a lot code 446 and a station number 448.

In this embodiment, the first group of instructions 450, sent by the server 200 to the personalization station 240, includes a power-up command of the portable electronic entity 100. An example of a first group of instructions 450 is illustrated in Figure 4H. It comprises an instruction number 452, a type of instruction 454 for Personalization Station 240 and a power-on instruction code 456. Personalization station 240 then retrieves and inserts the ATR identifier of the portable electronic entity in a report 458, an example of which is illustrated in FIG. 41. It comprises a report number 460, an identifier length ATR 462 and an identifier ATR 464, of variable length. The server 200 then defines each group of personalization instructions so that a group of instructions only ends when, for the next instruction, the server needs the execution report of at least one of the instructions. previous instructions.

For example, the first instruction of the new instruction group is an instruction involved in a cryptographic process. For example, the last instruction of the preceding group of instructions can be an APDU command called "get challenge" according to the ISO 7816 standard, which makes it possible to obtain from the card a "challenge", that is to say a random number, to enable the server 200 to authenticate itself by calculating a calculated authentication code by encrypting the "challenge" from a key, by means of an external secure hardware module called HSM (acronym for "Hardware Security Module" , and by sending this authentication code, by an APDU command called "external authenticate" (for external authentication) according to the ISO 7816 standard, to the portable electronic entity 100, which then compares it with the authentication code that she herself calculated from the same key, the challenge, and using means cryptographic, and which accepts authentication in the case where the two codes are equal.

FIG. 6A illustrates details of a group of personalization instructions 600. It comprises a first instruction 602, a second instruction 604, and so on until the last instructions 606 and 608, each instruction having a length variable.

FIG. 6B shows that an instruction 610 intended for the portable electronic entity 100 includes an instruction number 612 and an instruction type 614 that indicates whether an expected answer is specified. The instruction 610 also includes an instruction length 616, an APDU command 618, an expected response length 620 and, optionally, depending on the instruction type, an expected response content 622.

Two types of control instructions to the personalization station 240 are shown in FIGS. 6C and 6D. The type of control instruction 624 includes an instruction number 626, an instruction type 628, and an instruction code 630. The type of control instruction 632 includes an instruction number 634, a type of instruction instruction 636, instruction code 638 and data 640. Instruction types 628 and 636 indicate that the instruction is to station 240. Instruction codes 630 and 638 indicate, for example, whether it is This is a power-on instruction, a power off instruction, a clock change instruction, or a protocol selection instruction. The data 640 indicates, for example, a clock frequency or a voltage to be supplied to the entity 100. In these latter cases, the reporting instructions are implicit.

FIG. 6E illustrates an example of report 642 sent by personalization station 240 to server 200. This report 642 includes a report code 644, a first report information item 646, a second information item report 648 and so on until a last report information 650, each of the report information having a variable length. An example of report information 652 is given in Figure 6F. This report instruction 652 includes an instruction number 654, a response length 656 and a response 658 of variable length.

Upon receipt of the report, the server 200 analyzes the report, processes any anomalies (for example, stopping the customization), and sends a new set of personalization instructions to the personalization station 240 to continue the process. of customization. When the customization of a portable electronic entity is completed, the server 200 sends a specific instruction to the personalization station 240. The personalization station 240 can then automatically unload the portable electronic entity 100 from the reader 280 so that the station 240 continues. the personalization process, for example, by an embossing step on the same station or on a different station, and automatically load a new entity 100 into the reader 280 in order to initiate the electrical customization of this entity 100.

An example of a custom end of customization instruction 660 is illustrated in FIG. 6G. In embodiments, the specific end of personalization representative instruction is the only customization instruction of a personalization instruction group. This arrangement is advantageous in that it enables the server to analyze all the reports relating to a portable electronic entity before transmitting the representative end of personalization instruction. This specific instruction 660 includes an instruction number 662, an instruction type 664 which specifies that this instruction is destined for the station 240 and an end-of-personalization instruction code with no fault 666.

When the customization is completed, but has anomalies, the server 200 sends a specific instruction 668 to inform the personalization station 240, and therefore the operator of this personalization station 240. An example of such a specific instruction 668 is illustrated in FIG. 6H and comprises an instruction number 670, a type of instruction 672 which specifies that this instruction is intended for the station of customization 240 and end of customization instruction code with fault 674.

The end of customization statement, with or without an exception, may be at the end of a customization group of instructions. Preferably, this instruction is placed in a group without any other instruction. One can also provide a similar message sent by the server 200 to signal the end of customization of a batch of portable electronic entities 100.

Preferably, the personalization station 240 includes means for transmitting, to the server 200, a fault message and, in case of anomaly detection, the personalization server 200 stops the personalization (which can thus be taken over by the after ...). An example of station fault statement 676 is shown in Figure 61. This instruction

676 has a fault instruction code 678, a station number 680, and a fault code 682.

Of course, the data exchanged between the server 200 and the station 240 may be encoded according to any cryptographic protocol or algorithm.

Many variants or improvements can be envisaged for the personalization system. For example :

- It can be expected to make more complex control instructions to the personalization station. Thus, it may possibly be directly connected to an HSM, and a control task may consist of exchanging information with this HSM to perform authentication as described above.

- It can also provide more complex reporting instructions, for example to put only part of the responses of the electronic entity in the report, or insert the result of a treatment, for example partly arithmetical, realized by the station from the responses of the electronic entity.

in order to improve the personalization rate, the control instructions performed by the personalization station can be executed in parallel exchanges with the portable electronic entity. Thus, while awaiting the response of the electronic entity to a personalization instruction, the personalization station can analyze the response of the previous personalization instruction and insert the necessary information into said report.

- Also to improve the rate of customization, the preparation of the instruction groups by the server can be performed in parallel with the execution of groups of instructions by the personalization station. Indeed, part of the instructions of a new group of instructions is independent of the report of the previous group of instructions. The server can thus prepare this part of the instructions of a new group of instructions during the execution of the preceding group of instructions by the personalization station.

Claims

1 - Personalization device (200) for a portable electronic entity (100) comprising a memory (140), characterized in that it comprises:

processing means (220, 230) adapted to process personalization data and to generate at least one group of personalization instructions (436, 450, 602 to 608) of the portable electronic entity, at least one group of personalization instructions including at least one personalization control instruction (602-608) enabling a personalization station (240) to control the proper execution of at least one personalization instruction and

means for transmitting (235) each group of personalization instructions. 2 - Device according to claim 1, characterized in that at least one customization instruction (436, 450, 602 to 608) is an instruction directly understandable and executable by the portable electronic entity (100).

3 - Device according to any one of claims 1 or 2, characterized in that at least one personalization instruction (436, 450,

602 to 608) of a personalization instruction group enables the portable electronic entity (100) to register data in the memory (140) of the portable electronic entity.

4 - Device according to claim 3, characterized in that at least a portion of the data in the memory (140) of the portable electronic entity (100) is specific to the future carrier of the portable electronic entity.

5 - Device according to any one of claims 1 to 4, characterized in that at least one control instruction (602 to 608) is the expected result of the execution, by the portable electronic entity (100), d a customization instruction (602 to 608). 6 - Device according to any one of claims 1 to 5, characterized in that at least one customization instruction (602 to 608) is an order in APDU format of ISO 7816.

7 - Device according to any one of claims 1 to 6, characterized in that at least one control instruction (602 to 608) is an answer, in the APDU format of ISO 7816, a personalization instruction ( 602-608).

8 - Device according to any one of claims 1 to 7, characterized in that at least one group of personalization instructions comprises at least one control instruction of the personalization station.

9 - Device according to any one of claims 1 to 8, characterized in that at least one control instruction (602 to 608) is one of the following instructions: - a powering command of the electronic entity portable (100),

a command to switch off the portable electronic entity,

a command for selecting the applied clock of the portable electronic entity,

a command for determining a communication protocol between the personalization station (240) and the portable electronic entity,

a command for selecting the voltage applied to the portable electronic entity, a control for suspending the personalization for a determined duration,

a specification command at the customization station for a maximum waiting time to obtain a response from the portable electronic entity; a command for inserting a waiting time before each command sent to the portable electronic entity, a command for inserting data into said report sent to the attention of the server,

an end of customization command and / or

a personalization anomaly information command. 10 - Device according to any one of claims 1 to 9, characterized in that the processing means (220, 230) are further adapted to generate at least one personalization report instruction (602 to 608) enabling the personalization station (240) to confirm to the device the correct execution of at least part of a group of personalization instructions, the transmission means (235) being adapted to issue at least one account instruction sent to the personalization station, the device further comprising means for receiving (235) at least one report from the personalization station. 11 - Device according to claim 10, characterized in that the processing means (220, 230) are adapted to insert at least one report instruction (602 to 608) in at least one group of personalization instructions.

12 - Device according to any one of claims 10 or 11, characterized in that it further comprises analysis means (220, 230) capable of analyzing at least one received report and to trigger an action according to the result of said analysis.

13 - Device according to any one of claims 10 to 12, characterized in that the processing means (220, 230) comprise means for defining groups of instructions (436, 450) such that the device needs the account executing execution of at least one of the preceding instructions (602 to 608) to generate the first instruction of the next group of personalization instructions.

14 - Device according to any one of claims 1 to 13, characterized in that the processing means (220, 230) are adapted to generate a specific instruction representative of the end of personalization of a portable electronic entity (100). 15 - Device according to claim 14, characterized in that the processing means (220, 230) are adapted so that said specific instruction end of personalization end is positioned at the end of a group of personalization instructions (602 to 608). 16 - Device according to any one of claims 14 or 15, characterized in that the processing means (220, 230) are adapted so that said specific instruction representative end of personalization is the only personalization instruction (602 to 608 ) a group of personalization instructions (436, 450). 17 - Device according to any one of claims 1 to 16, characterized in that it comprises receiving means (235) of at least one identifier of the portable electronic entity (100).

18 - Device according to claim 17, characterized in that said identifier is an answer to initialization, or "answer to reset". 19 - Device according to any one of claims 17 or 18, characterized in that said receiving means (235) of at least one identifier of the portable electronic entity (100) are adapted to receive, in addition, at least an identifier of said personalization station (240).

20 - Device according to any one of claims 1 to 19, characterized in that the processing means (220, 230) are adapted to generate at least one group of personalization instructions (436, 450) in parallel with the executing a group of personalization instructions by the personalization station (240).

21 - Device according to any one of claims 1 to 20, characterized in that the processing means (220, 230) are adapted to generate at least one group of personalization instructions (436, 450) in which the first instruction personalization is an instruction involved in a cryptographic process.

22 - Device according to any one of claims 1 to 21, characterized in that it comprises a server and in that the transmitting means are adapted to transmit groups of personalization instructions to a plurality of personalization stations (240). 23 - Device according to any one of claims 1 to 22, characterized in that the portable electronic entity (100) is a card or an identification document.

24 - Device according to any one of claims 1 to 23, characterized in that the portable electronic entity (100) is of the slave type.

25 - Device (240) for customizing a portable electronic entity (100) comprising a memory (140), characterized in that it comprises:

means for receiving (260, 275) at least one group of personalization instructions (436, 450, 602 to 608) of the portable electronic entity, at least one group of instructions comprising at least one instruction of personalization control (602 to 608) for controlling the correct execution of at least one personalization instruction,

means for transmitting (280) at least one personalization instruction to the portable electronic entity and

processing means (260, 275) adapted to process each control instruction to check the correct execution of at least one personalization instruction by the portable electronic entity.

26 - Device according to claim 25, characterized in that at least one personalization instruction (602 to 608) is an instruction directly understandable and executable by the portable electronic entity (100).

27 - Device according to any one of claims 25 or 26, characterized in that at least one personalization instruction (602 to 608) of a group of personalization instructions (436, 450) allows the registration of data by the portable electronic entity (100) in the memory (140) of the portable electronic entity.

28 - Device according to claim 27, characterized in that at least a portion of the data in the memory (140) of the portable electronic entity (100) is specific to the future carrier of the portable electronic entity. 29 - Device according to any one of claims 25 to 28, characterized in that at least one control instruction (602 to 608) is the expected result of the execution, by the portable electronic entity (100), d a customization instruction. 30 - Device according to any one of claims 25 to 29, characterized in that at least one personalization instruction (602 to 608) is an order in APDU format of ISO 7816.

31 - Device according to any one of claims 25 to 30, characterized in that at least one control instruction (602 to 608) is a response, in the APDU format of ISO 7816, of a personalization instruction ( 602-608).

32 - Device according to any one of claims 25 to 31, characterized in that at least one group of personalization instructions comprises at least one control instruction of the personalization station.

33 - Device according to any one of claims 25 to 32, characterized in that at least one control instruction (602 to 608) is one of the following instructions:

a command for powering up the portable electronic entity,

a command to switch off the portable electronic entity,

a command for selecting the voltage applied to the portable electronic entity,

an end of customization command and / or

a personalization anomaly information command. 34 - Device according to any one of claims 25 to 33, characterized in that the processing means (260, 275) are adapted to perform at least one control instruction of at least one personalization instruction (602 to 608) after the transmitting means (280) has transmitted to the portable electronic entity (100) another personalization instruction not concerned by said control instruction.

35 - Device according to any one of claims 25 to 34, characterized in that the receiving means (260, 275) are further adapted to receive at least one personalization report instruction (602 to 608) and the processing means (260, 275) are further adapted to prepare an execution report of at least one group of personalization instructions, the device further comprising means for transmitting report to a personalization server (200).

36 - Device according to claim 35, characterized in that the receiving means (260, 275) are adapted to extract at least one report instruction (602 to 608) from at least one group of personalization instructions ( 602-608).

37 - Device according to any one of claims 35 or 36, characterized in that the processing means comprise a buffer memory (270) in which are stored the personalization instructions transmitted to the portable electronic entity (100) and the results execution at least a portion of the personalization control instructions, a report comprising all or part of the contents of said buffer memory.

38 - Device according to any one of claims 25 to 37, characterized in that it further comprises means for transmitting, to a personalization server (200), at least one identifier of the portable electronic entity (100).

39 - Device according to claim 38, characterized in that said identifier is an answer to initialization, or "answer to reset".

40 - Device according to any one of claims 38 or 39, characterized in that said transmitting means are adapted to associate with each portable electronic entity identifier (100), an identifier of the device (240).

41 - Device according to any one of claims 25 to 40, characterized in that it comprises means for transmitting an end of batch message.

42 - Device according to claim 41, characterized in that it comprises means for counting portable electronic entities (100), the processing means (260, 275) being adapted to generate said end of batch message when the means of count has determined that a lot of portable electronic entities has been customized.

43 - Device according to any one of claims 25 to 42, characterized in that it comprises anomaly detecting means and means for transmitting a fault message.

44 - Device according to any one of claims 25 to 43, characterized in that the portable electronic entity (100) is a card or an identification document.

45 - Device according to any one of claims 25 to 44, characterized in that the portable electronic entity (100) is of the slave type.

46 - A method of personalization of a portable electronic entity (100) comprising a memory (140), characterized in that it comprises:

a step of processing personalization and generation data (320) of at least one group of personalization instructions (436, 450, 602 to 608) of the portable electronic entity, at least one group of personalization instructions comprising at least one personalization control command (602 to 608) allowing a personalization station (240) to control the proper execution at least one customization instruction and

- A transmission step (320) of each group of personalization instructions to the personalization station of the portable electronic entity.

47 - A method of personalization of a portable electronic entity (100) comprising a memory (140), characterized in that it comprises:

a step of receiving (505) at least one group of personalization instructions (436, 450, 602 to 608) of the portable electronic entity, at least one group of instructions comprising at least one control instruction of personalization (602 to 608) for controlling the proper execution of at least one personalization instruction and

a step of transmitting (530) at least one personalization instruction to the portable electronic entity.